CCSP · Question #585
Which of the following threat types involves an application that does not validate authorization for portions of itself beyond when the user first enters it?
The correct answer is B. Missing function-level access control. Missing function-level access control (part of the OWASP Top 10) occurs when an application only verifies a user's authorization at initial login but fails to re-check permissions when the user navigates to different functions or URLs within the app. An attacker can bypass this b
Question
Which of the following threat types involves an application that does not validate authorization for portions of itself beyond when the user first enters it?
Options
- ACross-site request forgery
- BMissing function-level access control
- CInjection
- DCross-site scripting
How the community answered
(17 responses)- B94% (16)
- C6% (1)
Explanation
Missing function-level access control (part of the OWASP Top 10) occurs when an application only verifies a user's authorization at initial login but fails to re-check permissions when the user navigates to different functions or URLs within the app. An attacker can bypass this by directly accessing protected URLs or functions. Cross-site request forgery (CSRF) tricks an authenticated user into submitting unintended requests. Injection involves sending malicious data to an interpreter. Cross-site scripting (XSS) injects malicious scripts into web pages viewed by other users.
Topics
Community Discussion
No community discussion yet for this question.